The Puppet Master
Author: 0xIDA
Platform: HTB · Category: osint · Difficulty: Very Easy
Platform: HTB | Category: OSINT | Difficulty: Very Easy
Target: 154.57.164.69:31170
Solvers
Summary
A progressive OSINT web quiz that challenges the investigator to identify a military vehicle shown in a banner image on the NZDF (New Zealand Defence Force) website, then answer 5 questions about its specifications through publicly available information (Wikipedia).
Methodology
1. Reconnaissance
The web app is a React SPA served by nginx. Downloaded the JS bundle to discover:
POST /api/start-challenge— starts session, returns questionsPOST /api/submit-answer— submit answer per questionPOST /api/get-flag— returns flag when all correct
The image URL pointed to nzdf.mil.nz (New Zealand Defence Force).
2. Image Source Analysis
The banner image URL: https://www.nzdf.mil.nz/assets/Uploads/BannerImages/20230525_NZDF_P1061532_025__...
Searched NZDF's May 2023 news archive for "P1061532" → Found article "Making critical decisions in combat a key focus for large army exercise in Waiouru" which mentions both "NZ Light Armoured Vehicles" and "Bushmaster Protected Mobility Vehicles".
3. Vehicle Identification
The image shows a Bushmaster Protected Mobility Vehicle (not an NZLAV). Verified via:
- NZDF glossary references "Armoured Bushmaster Vehicle"
- Wikipedia article on Bushmaster PMV
Answer Chain
| # | Question | Answer | Source |
|---|---|---|---|
| 1 | Vehicle type | Bushmaster | NZDF article + Wikipedia |
| 2 | Manufacturer | Thales Australia | Wikipedia: designed/manufactured by Thales Australia (formerly ADI) |
| 3 | Service entry | 1997 | Wikipedia infobox: "In service: 1997–present" |
| 4 | Country of origin | Australia | Wikipedia: "Place of origin: Australia" |
| 5 | Passenger capacity | 9 passengers and 1 driver | Wikipedia: "Crew: 1 (driver), 9 (passengers)" |
Flag
HTB{c0mb1n1ng_r34l_w0rld_4nd_s3lf_c0nt41n3d_OSINT!}
Reads as: "combining real world and self contained OSINT"